4 ms·

The web/cloud world is so much nonsense. First, why do you even need HTTPS on a trusted network. Also if you want a trusted network, why not just use IPSec? HTT

The web/cloud world is so much nonsense. First, why do you even need HTTPS on a trusted network. Also if you want a trusted network, why not just use IPSec? HTTPS was specifically built to work over the Internet because it was too hard to switch from IPv4. Second, if it's private, surely you can just use your own Certificate Authority, instead of paying a tax to be listed on someone else's Certificate Authority.

pravus 3y ago
> First, why do you even need HTTPS on a trusted network. PCI compliance among many other regulatory issues. You will be required to show that data is not only encrypted at rest but is encrypted through your entire transport chain regardless of any physical security. The threat model assumes that an attacker is able to temporarily access network resources undetected and can use simple sniffing tools to egress sensitive data. This will not be optional.
- mgaunard 3y ago
  That's a whole lot of nonsense. What if you push your data using a custom binary protocol over UDP multicast? Are you suggesting that regulations make it so that everything should be a slow and inefficient https webapp?
dvdkon 3y ago
Trusted networks are a flawed concept, unless you mean a software-backed tunnel. And I'm glad the slightly-less-mad TLS won over IPSEC with some certificate extension.
wolletd 3y ago
Well, because my local instance of <WebApp> says, <Feature> isn't available unless I use HTTPS. Also, HTTPS with a public CA just works on most systems, whereas IPsec requires Client configuration. It's still easier to roll out than switching from IPv4. For personal or experimental things, I may use a local CA, but getting certificates for the internal subdomains of my company is trivial when you already got a public domain on a Server that's capable of using DNS-01 challenges. Enabling HTTPS is just way easier than actually ensuring you can trust your local network. Many real-life middle-class companies start out with just having a network and not thinking about security at all. Some companies may even have untrusted internal networks by choice by allowing BYOD.
- mgaunard 3y ago
  Stop relying on web stuff built by others full of artificial limitations? Either write your own code or choose your dependencies more carefully.
preseinger 3y ago
how do you know your network is trusted and/or private? trick question: you can't even the network links between hosts in a single rack in a DC can be vulnerable
- mgaunard 3y ago
  I own the machines, the switches, the routers and the cables.
  - cratermoon 3y ago
    And you're certain that no one will ever access your network negligently or with malicious intent?
  - preseinger 3y ago
    where does all of that hardware live? unless it's in your home, it's not trustable
    - mgaunard 3y ago
      Have you never been to a datacenter? They require your fingerprints for entry and everything is heavily monitored. You can even get a stealthy cage if you don't want anyone to be able to see what kind of network equipment you have.
      - preseinger 3y ago
        and a government warrant bypasses all of that there was this whole thing with edward snowden a few years ago, maybe you remember?

pravus 3y ago

> First, why do you even need HTTPS on a trusted network. PCI compliance among many other regulatory issues. You will be required to show that data is not only encrypted at rest but is encrypted through your entire transport chain regardless of any physical security. The threat model assumes that an attacker is able to temporarily access network resources undetected and can use simple sniffing tools to egress sensitive data. This will not be optional.

mgaunard 3y ago
That's a whole lot of nonsense. What if you push your data using a custom binary protocol over UDP multicast? Are you suggesting that regulations make it so that everything should be a slow and inefficient https webapp?

dvdkon 3y ago

Trusted networks are a flawed concept, unless you mean a software-backed tunnel. And I'm glad the slightly-less-mad TLS won over IPSEC with some certificate extension.

wolletd 3y ago

Well, because my local instance of <WebApp> says, <Feature> isn't available unless I use HTTPS. Also, HTTPS with a public CA just works on most systems, whereas IPsec requires Client configuration. It's still easier to roll out than switching from IPv4. For personal or experimental things, I may use a local CA, but getting certificates for the internal subdomains of my company is trivial when you already got a public domain on a Server that's capable of using DNS-01 challenges. Enabling HTTPS is just way easier than actually ensuring you can trust your local network. Many real-life middle-class companies start out with just having a network and not thinking about security at all. Some companies may even have untrusted internal networks by choice by allowing BYOD.

mgaunard 3y ago
Stop relying on web stuff built by others full of artificial limitations? Either write your own code or choose your dependencies more carefully.

preseinger 3y ago

how do you know your network is trusted and/or private? trick question: you can't even the network links between hosts in a single rack in a DC can be vulnerable

mgaunard 3y ago
I own the machines, the switches, the routers and the cables.
- cratermoon 3y ago
  And you're certain that no one will ever access your network negligently or with malicious intent?
- preseinger 3y ago
  where does all of that hardware live? unless it's in your home, it's not trustable
  - mgaunard 3y ago
    Have you never been to a datacenter? They require your fingerprints for entry and everything is heavily monitored. You can even get a stealthy cage if you don't want anyone to be able to see what kind of network equipment you have.
    - preseinger 3y ago
      and a government warrant bypasses all of that there was this whole thing with edward snowden a few years ago, maybe you remember?